Linux MPTCP flaw enables remote root; Anthropic shows exploit (CVE-2026-98432)
Original title: Anthropic AI model finds Linux kernel bug that leads to remote root access
The kernel use-after-free scores 9.8, hits branches back to 4.4, and needs an exposed MPTCP listener.
Anthropic disclosed CVE-2026-98432, a race-condition use-after-free in Linux IPv4 TCP connection setup, and demonstrated a zero-click exploit built with an unreleased Claude research model. An unauthenticated attacker who can reach an MPTCP listener can leak kernel memory, bypass KASLR, and run commands as root. Upstream fixes defer object release until after an RCU grace period. Ubuntu and Red Hat Enterprise Linux had not shipped patched kernels as of October 30.
Unconfirmed: The working exploit is Anthropic’s demonstration; the text does not say attackers are using it.
- Anthropic’s proof of concept reached root command execution in about 53 minutes.
- Fixed releases include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7.
- The flaw affects eight kernel branches dating back to version 4.4.
- Debian, Oracle Linux, SUSE and Amazon Linux have fixes for at least some releases.
- MPTCP is opt-in, but eBPF or configuration can force applications to use it.
Impact: Unauthenticated remote command execution as root
| Product | Affected | Fixed in |
|---|---|---|
| Linux kernel | eight branches dating back to version 4.4 | 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7 |
- 1.Review kernel versions and install the listed fixed releases or distribution packages.
- 2.Check whether systems expose MPTCP listeners.
- CVEs
- CVE-2026-98432
- Products
- Linux kernelMPTCP
- Organizations
- Anthropic
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×14 |
From the original article
2 min read at csoonline.com
Linux servers running Multipath TCP (MPTCP) could be vulnerable to remote code execution through a flaw in the kernel’s networking stack. Anthropic has disclosed a zero-click exploit developed with an unreleased Claude research model that allows an unauthenticated attacker to execute arbitrary commands as root, without requiring any user interaction.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.